[German]Microsoft's parking garages in Redmond, USA, are in trouble. Their car park control system and servers has been unprotected and accessible via the Internet.
Advertising
Tim Philipp Schäfers, founder of the German portal Internetwache.org has once again found a weakness in a control system. From time to time Schäfers takes a look at parking garages to check their IT for security risks. A few years ago he found out that the control software for parking garages was not sufficiently secured by some companies. He had made a case from Switzerland 2016 at Golem public in this German article. Even car park barriers at the entrances and exits could have been manipulated.
Gotcha Microsoft!
Tim Philipp Schäfers came across a new case in November. Schäfers is using the network scanner Zmap to search for installations of parking garage software that are publicly accessible via the Internet. During a search he found a parking lot overview for a parking garage with a Microsoft logo. It quickly became clear that it was the parking garage management of the Microsoft headquarters in Redmond, USA.
Schäfers was able to access the car park management software of the Microsoft headquarters in Redmond, USA, via an unencrypted connection without any protection. A map of the Microsoft site in Redmond with the parking garages available there could be accessed via a web interface. To the surprise of Tim Philipp Schäfers, he was able to view all parking garages and parking decks as well as the occupancy of the parking bays. This is controlled by sensors.
It was also possible to inquire whether a parking space was reserved and when it was used (although it is not possible to inquire the license plates or personal data of the employees there). However, it was possible to acknowledge accumulated alarms for sensor errors without further authentication.
Schäfers passed the information to Golem, who published the case in an German article. There it can be read that besides the car park control, the RDP and SMB ports of the servers concerned were openly accessible on the Internet. There the admins probably did not read Microsoft's recommendations. Was the old problem: The Azure server was operated by third parties, according to Microsoft's answer to Schäfer's advice.
Advertising
On November 28, the case was reported by Schäfers to Microsoft Cert (Computer Emergency Response Team). A week later they respond: We are investigating it, on December 12 the report was closed (the responsible team was informed about the reported problems). There was no bug bounty for this, and the maintenance is not part of the team's remit.
After all, the web interface of the Azure server disappeared from the Internet, but the RDP and SMB ports still remained open. Golem tried another scan shortly before the incident was revealed in this article. The car park software was accessible again via the reported IP address. Golem describes in the article the statement of Microsoft and the Austrian software manufacturer Indect. After a further inquiry, the car park software disappeared from the Internet, but the ports remained accessible.
